Hacktron's HEIF Heist chain from Discourse to OpenAI Codex
A concrete case study in how agent-assisted exploit work, a native image-decoder bug, and loose identity/connectors can turn into cross-product access quickly.
Logged at IST: 2026-09-18 10:02 IST
What it is: One combined entry for Hacktron's OpenAI compromise write-up, the broader HEIF Heist research, the Discourse security advisory, and the related LiveOverflow explainer link.
Gist: Hacktron says it chained a libheif/ImageMagick remote-code-execution path in OpenAI's Discourse forum with an OpenAI SSO flaw. The claimed result was no-interaction takeover of OpenAI employees' ChatGPT/Codex accounts, with potential reach into connected services such as GitHub, Slack, and email.
They demonstrated impact by asking an employee's Codex account to open a harmless pull request in OpenAI's internal openai/openai monorepo, then stopped further testing. The write-up says OpenAI fixed the issue the same day, and OpenAI later paid a $6,500 bounty for the OpenAI-side finding.
The Discourse advisory gives the concrete patch hook: GHSA-vhm9-85gw-x335 / CVE-2026-32882, high severity 8.8, describes remote code execution via malformed HEIF image uploads, and lists patched Discourse versions 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6. It also notes that current Discourse core adds image-processing sandboxing as defense in depth.
The broader HEIF Heist site frames the issue as an ecosystem problem rather than a one-off Discourse bug. Many products accept HEIF, HEIC, or AVIF uploads that eventually flow into native decoders such as libheif and libde265 through ImageMagick, libvips, Sharp, distro packages, and container images. Hacktron lists related impact across OpenAI, Slack, Meta, Discourse, Next.js image optimization, GitHub Enterprise, and other frameworks/CMSes.
LiveOverflow's transcript adds two useful details. The original video apparently included a recording of the OpenAI internal PR proof, but LiveOverflow says OpenAI asked them not to show it, so the published video uses a reenactment. The technical arc matches the written sources: HEIF upload handling in Discourse routes through ImageMagick, libheif had an accidentally-fixed-but-untracked heap-overflow path, agent-assisted exploit adaptation bridged local Discourse to OpenAI's hosted environment, and the proof stopped at a harmless Codex PR rather than reading private repository contents.
The deeper point is economic: Hacktron argues that agent-assisted exploit development compressed work that used to require rare expertise and sustained effort into a few days of agent time plus a few hours of human guidance. That makes old assumptions about "known but hard to weaponize" dependency bugs much weaker.
Newsletter angle: Treat image decoding as an untrusted native execution boundary. Patch libheif/libde265 and affected applications, but also sandbox or disable untrusted HEIF/AVIF processing where it is not needed, especially when the surrounding product has powerful identity and connector reach.